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Abstract. The paper introduces the notions of an elliptic pair, an elliptic cycle and an 
elliptic list over a square free positive integer d. These concepts are related to the notions of 
amicable pairs of primes and aliquot cycles that were introduced by Silverman and Stange 
in [5] . Settling a matter left open by Silverman and Stange it is shown that for d = 3 there 
are elliptic cycles of length 6. For d 7^ 3 the question of the existence of proper elliptic lists 
of length n over d is reduced to the the theory of prime producing quadratic polynomials. 
For d = 163 a proper elliptic list of length 40 is exhibited. It is shown that for each d there is 
an upper bound on the length of a proper elliptic list over d. The final section of the paper 
contains heuristic arguments supporting conjectured asymptotics for the number of elliptic 
pairs below integer X. Finally, for d =s 3 the existence of infinitely many anomalous prime 
numbers is derived from Bounyakowski's Conjecture for quadratic polynomials. 



1. Introduction 

Throughout this paper d will denote a positive square-free integer, and prime numbers p 
and q will be larger than 3. Consider an elliptic curve group E over the rational numbers. 
Suppose that for some fundamental discriminant d the group E has complex multiplication 
in Q^—d): If E has good reduction over a finite field K then the order of the corresponding 
elliptic curve group is computed from \K\ and d. Depending on the value of d there are two, 
four or six possible values for this order. Some of these values may be prime. We consider 
the problem of finding a prime number p and a fundamental discriminant d such that a 
corresponding elliptic curve group over the field ¥ p has prime order q. 

In Section |2] we examine for a given value of d ordered pairs (p, q) of prime numbers related 
as above, and introduce the notion of an elliptic pair over d. Although the definition of the 
binary relation of being an elliptic pair over d does not appear to introduce a symmetric 



relation, we prove that this relation is in fact symmetric (Theorem 2.7), a fact we refer to as 



"the law of elliptic reciprocity" . The relation of being an elliptic pair imposes constraints on 



the prime numbers so related. Our first result in this direction is given in Theorem for 
the case when d is not 3, returning to the case d = 3 in a later section. We also show that a 
special integer A identified by Silverman and Stange for the d = 3 case has an analogue for 



other values of d (Theorem 2.9 and Corollary 2.10). This integer is useful for ruling out pairs 



of prime numbers that are not elliptic pairs over a given d, and it is also useful in identifying 
the d over which a given pair of prime numbers could be an elliptic pair. 

The case when d is 3 in several instances has to be handled separately. Though Section [3] 
contains results for general d, it is dominated by results about d = 3. In this section we take 



2010 Mathematics Subject Classification. 14H52, 14K22, 11G07, 11G20, 11B99. 

Key words and phrases. Elliptic curve, elliptic pair, elliptic list, elliptic cycle, elliptic reciprocity. 

Supported by National Science Foundation grant DMS 1062857. 

§ Corresponding Author: liljanababinkostova@boisestate.edu. 



up the question of how long directed paths (elliptic lists) or cycles (elliptic cycles) can be 
found in the "elliptic pair over d" relation. First we establish the special place of d = 3 in 
this question. If for a d there is a proper elliptic cycle of length n > 3 over d, then d = 3 and 



n = 6 (Theorem 3.4). And then we proceed, using several additional constraints on elliptic 
cycles for d = 3 derived in this section, to search of elliptic cycles over d = 3 not ruled out by 
our results. One of the main computational results of this section is finding a proper elliptic 



6-cycle over d — 3. Corollaries (3.6) and (3.7) and Theorem (3.8) provide information that 



makes the search for elliptic 6-cycles over 3 more efficient than a brute force search. Our 
findings in this section clarify points left open in Remark 6.5 on [5]: In particular, there are 
proper elliptic cycles of length larger than 3 when d — 3. 

Having determined in Section [3] that for d = 3 proper elliptic lists and proper elliptic cycles 
over 3 of length 6 exist, and that this is the optimal length, and having determined that for 
d 7^ 3 proper elliptic cycles cannot have length larger than 2 we turn to the question of the 
length of proper elliptic lists for d ^ 3 in Section |4j In Theorem 4A we connect the problem of 



existence of proper elliptic lists of length n over d ^ 3 with quadratic polynomials generating 
n consecutive prime values. Using a classical prime generating quadratic polynomial of Euler 



we exhibit a proper elliptic list of length 40 over d = 163. In Theorem 4.2 and Corollary 



4.3 we derive upper bounds on the length a proper elliptic list over d ^ 3 can have. We do 
not have any indications on whether this upper bound is optimal. In anticipation of further 
research on this topic, we introduce three functions defined on the set of squarefree positive 
integers: Ai, the "maximal allowable list length" function, C, the "maximal achievable list 
length" function, and /, the function that measures the discrepancy between M. and C. On 
very meager evidence we suspect that this discrepancy function may be computable in terms 
of the class function h - i.e., the values f(d) may be related to the values h(—d). 

In the final section, Section [5j we give heuristic arguments to support a conjecture on an 
asymptotic estimate in terms of d and X for the number of elliptic pairs over d occurring 
below an integer X. Finally, in Theorem 5.1] we derive for d =g 3 the existence of infinitely 



many anomalous primes from Bunyakowski's Conjecture for quadratic polynomials. 



The Appendix contains a proof of Theorem 2.4, and two tables of data supporting some 
of our work. 

2. Elliptic Pairs 

Because fields of characteristic 2 and 3 often must be considered separately when dealing 
with elliptic curves, we restrict our paper to prime numbers larger than 3. From now on, all 
prime numbers p and q are without further comment assumed to be larger than 3. 

Definition 2.1. For a square-free positive integer d, an ordered pair (p, q) of prime numbers 
is said to be an elliptic pair over d if there exists an elliptic curve E with complex mul- 
tiplication (CM) in Q.(y—d) having order q when examined over ¥ p . The notation (p, q)d 
denotes the fact that the ordered pair of prime numbers (p, q) is an elliptic pair over d. The 
witnessing curve E is called a representative curve of the pair. 

For example, (7, 13) 3 is an elliptic pair because the representative curve E : y 2 = x 3 + 3 
has order 13 when considered over the field F 7 . 



It should be noted that Definition 2.1 as given is not a symmetric relation in p and q. 



Theorem 2.7 below addresses this point. 



Definition 2.2. An elliptic prime (over d) is a prime number which is the first entry in 
an elliptic pair over d. 



For example, in Definition |2.1[ p is an elliptic prime over d. In the example following 
Definition 2A_, 7 is an elliptic prime over 3. 

Lemma 2.3. If the prime number p is an elliptic prime over d, and if d = 4 3, then d = 8 3. 

Proof. Let d = 4 3, be a given fundamental discriminant, and let p be an elliptic prime 
number over d. We may assume d > 3. Assuming that p is not prime in Z(\/— ~d), let a and 
b be the unique positive integers such that 4p = a 2 + db 2 . 

Let £ be a representative curve witnessing that p is an elliptic prime over d. If E has 
CM in Q(y/—d), then JfE(W p ) — p + 1 ± a. Then, as p + 1 is even and #E(W P ) is a prime 
number, a must be odd. If it were the case that d = 8 7, then 4 = 8 4p = a 2 + db 2 = 8 a 2 — b 2 . 
But since a is odd, a 2 = 8 1, implying 6 2 = 8 5. But the congruence x 2 = 8 5 does not have a 
solution, a contradiction. Thus, as d = 4 3 we must have d = 8 3. □ 

Among the fundamental discriminants with ci = 4 3, the case of d = 3 has to be 
treated separately. The curves E with CM in Q(v — 3) are precisely those with j(E) G 
{0, 54000, -12288000} [4J. Curves with j(E) = 54000 have trivial 2-torsion, but some curves 
with j(E) = 0, —12288000 have trivial torsion (over Q), so we must consider those. Curves 
with j = —12288000 are covered fully in [5], and they can be treated in exactly the same 
way as other curves with CM, so we omit a full discussion of them here. When j(E) = 0, E 
has the form E : y 2 = x 3 + k for k G Z, gcd(k,p) = 1. Now, p = a 2 + 3b 2 and #E(W p ) takes 
on one of six values: 

Theorem 2.4. Let p > 3 be an odd prime and let k ^ p 0. Let N p denote #E(F P ), where 
E is the elliptic curve y 2 = x 3 + k. Here, QR and CR denote quadratic residue and cubic 
residue, respectively. 

(a) Ifp = 3 2, then N p = p + 1. 

(b) If p =3 1, write p = a 2 + 36 2 |^] where a,b are integers with b positive and a =3 — 1. 
Then 

p + 1 + 2a if k is a sixth power mod p 
p +1 — 2a if k is a CR, but not a QR, mod p 
p + 1 — a ± 36 if k is a QR, but not a CR, mod p 
^p + 1 + a ± 36 if k is neither a QR nor a CR mod p. 

Proof. This result is well-known; the proof is entirely computational and is contained in 
Appendix |a} The end result is that N p — p + 1 — tt — 7f, where ir = —X6{k)~ 1 J{x2, Xs)- This 
Jacobi sum is evaluated as J(x2, X3) — a + iby/3, with a =3 — 1 [TJ. □ 

It immediately follows that if (p, q)% is an elliptic pair, then p =3 1. Note also that if k is 
a QR modulo p then 3\N p , and if A: is a CR modulo p then 2\N p . From this observation, two 
corollaries follow immediately: 

Corollary 2.5. Let p =3 1 be a prime and let E : y 2 = x 3 + k be an elliptic curve with 
k ^ p 0. If #E(W P ) is prime, then k is neither a QR nor CR, except in the case where p = 7 
and k =7 4 (in which case Nj = 3). 



Most previous authors formulate this theorem using p = a? — ab + b 2 instead. 
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Corollary 2.6. Let p > 7 be a prime, and let E : y 2 = x 3 + k be an elliptic curve. Then 
#E(Fp) can take on at most 2 prime values, both of which are equivalent to 1 mod 3. 

Theorem 2.7 (The Law of Elliptic Reciprocity). If (p,q)d is an elliptic pair, then so too is 

Proof. This is a direct consequence of Theorem 6.1 in [5] for d ^ 3 and for curves of non-zero 
j'-invariant for d = 3. 

When d = 3 and j = 0, we use Theorem 7.1(d) in [5], which states that if E : y 2 = x 3 + k 
has prime order q modulo p, then E has order p modulo q if and only if 

where (:) g is the sextic residue character. Since l/6 th of all 4k coprime to p ^ 2,3 have 
(po) = l±% ^ for a particular choice of sign, we can choose k such that j = 1 +* v ^ and 

(if) = 1 ~2 V ^ ' so (if) (if) = ^' r ^ n ^ s demonstrates that if (p, g) 3 is an elliptic pair, then 
so too is (q,p)3- □ 
One consequence of Theorem |2.7 is the following: 

Theorem 2.8. Let (p, q)d be an elliptic pair with p < q and j of the representative curve non- 
zero, and a p , bp, a q , b q be the unique positive integers such that 4p = a 2 -\-db 2 and 4q = a 2 + db 2 . 
Then a q = a p + 2 and b q = b p . 



Proof. We know that q = p + 1 + a p and by Theorem 2.7 that p = q + 1 — a q , so a q = a p + 2. 
Then because \(a 2 p + db 2 ) = p and \{a 2 + db 2 ) = q, 

a l + d K | i | n _ < + dh \ 

4 + 1 + a P ~ 4 

{a p + 2) 2 + db\ = a\ + c#^, 

from which is follows that b q = b p . □ 

The corresponding case of the above Theorem for d = 3 with representative curve having 
j = will be covered in Section [3j As we shall remark below, the number A pq treated in the 
following three results is very useful in analyzing the relation (p, q)^. 

Theorem 2.9. Let {p,q)z be an elliptic pair. There exists an integer A = A pq such that 

2 2pg + 2p + 2q — p 2 — q 2 — 1 
3 

Choose the sign on A such that A =4 p + q + 1. Then E : y 2 = x 3 + g m , where g is a 
particular primitive root modulo q, can have one of six orders N q over¥ q : 



(1) Ifm= t 


0: 




= \(p + q + l + 3A), 


(2) I/m= e 


1: 




= P, 


(3) J/m= e 


2: 




= l{p + q+l-3A), 


(4) //m=e 


3: 


N q 


= |(-p + 3g + 3-3A) 


(5) //m=e 


4: 


N g 


= 2q + 2-p, 


(6) //m=e 


5: 


N q 


= l(-p + 3q + 3 + 3A) 



Proof. The existence of A is proven in [5] (Corollary 7.6(a)). The rest follows from comparing 
the orders in terms of A (Corollary 7.6(b) of [5]) and in terms of the values given in our 



Theorem 2.3 The six values from [3] are: 



q + l±(q + l-p), 
q + l±l(q + l-p + 3A), 
q + l±l(q + l-p-3A). 

Note that if our choice of primitive root g does not make the order of E : y 2 = x 3 + g over 
F q equal to p, then we can take g ^— g^ 1 to produce the desired result. □ 

Corollary 2.10. Let (p,q)z be an elliptic pair with representative of invariant j = 0. If we 
write p = a 2 + 3b 2 , with a =3 — 1, and we choose the sign on b such that q = p + 1 + a — 3b, 
then A pq = a + b. 

Proof. We calculate: 

2pq + 2p + 2q — p 2 — q 2 — 1 



A 1 
pi 



2(a 2 + 36 2 )(a 2 + 3b 2 + 1 + a - 3b) + 2(a 2 + 3b 2 ) + 2(a 2 + 3b 2 + 1 + a - 3b) 

3 

(a 2 + 36 2 ) 2 + (a 2 + 3b 2 + 1 + a - 3b) 2 + 1 



= - [(2a 4 + 6a 2 6 2 + 2a 2 + 2a 3 - 6a 2 6 + 6a 2 6 2 + 186 4 + 66 2 + 6a6 2 - 186 3 
3 

+ \ [(2a 2 + 66 2 ) + (2a 2 + 66 2 + 2 + 2a - 66) - (a 4 + 6a 2 6 2 + 96 4 )] 

- \ [a 4 + 6a 2 6 2 + 2a 2 + 2a 3 - 6a 2 6 + 96 4 + 66 2 + 6a6 2 - 186 3 + 1 + 2a - 66] 

- - [a 2 - 6a6 + 96 2 + l] 
o 

= \ [3a 2 + 36 2 + 6a6] = (a + 6) 2 . 

Then, A pq = 4 p + q + 1 = 4 p+ (p+ 1 + a - 36) + 1 = 4 2p + 2 + a - 36. As p is odd, 4|(2p + 2), 
so A =4 a — 36 =4 a + 6. We know that a + 6 is odd because p is odd, so — (a + 6) ^ 4 a + 6. 
Therefore, A = a + 6. □ 



We can also state Corollary 2.10 for d ^ 3. 



Corollary 2.11. Let d be a squarefree positive integer larger than 3 and Let [p,q)d be an 
elliptic pair over d with p 7^ q Then there exists an integer A pq such that 

2 _ 2pq + 2p + 2q - p 2 - q 2 - 1 

Indeed, A pq = b p {= b q ). 

Proof. We write Ap = a 2 + db 2 . Using the fact that p < q and (p, q)d is an elliptic pair over 
d, we have q = p + 1 + a p . A straightforward computation shows that A = b p = b q . □ 
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The number A pq is useful: Given p, q and d we can compute 2 pi +2 p+ 2 i-p -i ~ 1 > an( } then 
we know immediately that if this number is not a perfect square, then (p, q)d is not an elliptic 
pair. Moreover, given only p and q within each other's Hasse intervals, we can compute the 
numerator of the quantity and factor out any perfect squares to compute a d for which 
(p, q)d could be an elliptic pair. This provides a convenient proof that p and q sufficiently 
close together form an elliptic pair for exactly one square-free value of d. 

3. Elliptic Lists and Elliptic Cycles 

Definition 3.1. The symbol (pi,P2, ■■■Pn)d denotes an elliptic list of length n over d if 

each of (p 1 ,p 2 ) d , ip2,Pz)d, (p n -i,Pn)d is an elliptic pair. If p x ,p 2 , ...,p n are all distinct 
primes, then the elliptic list is a proper elliptic list of length n over d. 



We will see in Theorem that proper elliptic lists of length n > 3 over d = 3 are all 
represented by elliptic curves of zero j-invariant, so we will take j = and d = 3 to be 
equivalent cases throughout this section. 

Theorem 3.2. Let ijPi,p 2 ,Pz,Pi,p^)2, be an elliptic list withpi,p 5 7^ p 3 and p 2 ^ Pi, then 

Pi~P2=P5- Pi- 
Proof. Let p 3 = a 2 + 3b 2 , and choose b so that A paP4 = a + b. Then p 5 = p 3 + 3 + 3a — 3b. 



Likewise, A P2P3 = a — 6, so p\ = p 3 + 3 + 3a + 36. Thus, p\ — p 5 = 66. By Theorem 2.3 



P2 — Pi = 66, so pi — p 5 = p 2 — p^ Rearrangement of terms gives the stated result. □ 

Definition 3.3. Let {pi,p 2 , • Pn)d form an elliptic n-cycle over d (or elliptic cycle of 
length n over d) if (pi,p 2 ,p 3 , ...,p n )d forms an elliptic list and {p n ,Pi)d forms an elliptic 
pair. If the list is proper, then we say that we have a proper elliptic n-cycle. 

Theorem 3.4. // a proper elliptic n-cycle over d exists for n > 3, then d = 3 and n = 6. 

Proof. When j ^ (d ^ 3 and some d = 3 curves), this result strengthens Corollary 6.2 of 
[5], but it utilizes the exact same proof. Recall that if j 7^ 0, then #E(F P ) — p + 1 ± a. In 
particular, one of these values is greater than p, and the other is no larger than p. If we 
have a proper elliptic cycle over d, it has a least element. Let p be this least element, and 
let (p,q)d and (r,p) d be the elliptic pairs it is part of. Then either q or r is less than p, a 
contradiction. 



Now let d — 3 and j = 0. We note that by Theorem |3.2[ pi — p 2 = p 5 — p 4 . Suppose that 
Pi = Pi, i-e. we have a 3-cycle. Then 

Ph ~ Pi = Pi ~ P2 = Pi - P5, 

so pi = p^, and the cycle is not proper. 

Suppose that n = 4. then p\ — p 2 = p 5 — p<±. But because we have a 4-cycle, p\ = p$, so 
P2 = Pi, and the cycle is not proper. 

Now we let n = 5. We have that p\ — p 2 = p$ — p^ and p 2 — p 3 = p§ — ps, so 

Pe - Pi = Pi ~ Pa- 
Setting pi = p 6 implies that p 3 = p 4 , so the cycle is not proper. 
Now let n > 6. Again, pi — p 2 = p 5 — p 4 and p 2 — p 3 = p e — p 5 , so 



Pa ~ Pi = Pi - P3- 
6 



But now, P3 — P4 = pj — pe, so 

Pi ~ Pi = P7 ~ P4, 

and thus p\ = p?. This means that if a proper n-cycle has length at least 6, then it has 
length exactly equal to 6. □ 

Given only a single case left to check to see if there are any proper elliptic cycles other 
than elliptic pairs, we searched for elliptic cycles over d = 3. The following results aid in 
directing such a search: 

Theorem 3.5. Let (pi,P2,P3,Pi)3 be a proper elliptic list. If p 1 = a 2 + 3b 2 , with a = 3 — 1, 
then p 4 = (-a - 2) 2 + 3b 2 . 

Proof. We choose b such that pi = c 2 + 3d 2 = p + 1 + a — 36. It follows from Corollary 2.10 
that a + b = c + d for suitable choice of d. Solving for c and d, we get that 



C - 



d 



a-b+l 



Note that p 2 + 1 + c - 3d = p 1 + 1 + a - 3b + 1 + \{a + 36 - 1) - §(a - b + 1) = pi, so 
P3 = P2 + 1 + c + 3d. 

Let p 3 = e 2 + 3/ 2 . Choose / such that c — d = e + f. Then 

c— 3d— 1 — q+3b— 3 

2 2 ' 

X _ c+d+1 _ a+b+1 
J 2 2 ' 

Now, p3 + l + e-3/=p 2 + l + c + 3d+l + e=f=± - 3^f±l = p2j so p4 = p3 + i + e + 3/. 
Now let P4 = g 2 + 3/i 2 , and choose h such that e — f — g + h. Then 

„ _ e-3/-l _ (-a+3fr-3)-3(a+fe+l)-2 _ _ _ 9 

y — 2 ~ 4 — az, 

e+/+l _ (-a+3o-3)+(a+P+l)+2 

□ 



n — 2 — 4 — 



Corollary 3.6. Let (pi,P2,P3,P4,P5,Pe)3 be a proper elliptic list, and let pi = a 2 + 3b 2 , with 
a =3 — 1. Then: 

/a + 36-l\ 2 /a-6 + l x2 
P2 = S + 3 



P3 



-a + 36 — 3\ 2 /a + 6 + l x 



2 

p 4 = (- a - 2) 2 + 36 2 



-a — 36 — 3 \ 2 n f a — 6+l x ^ 



= ^ + 3 



, a-36- 1\ 2 /a + 6+ l x 2 

= = + 3 



Proof. The values for P2,P3,P4 are given in the proof of Theorem |3.5| Note that the process 
to obtain p§ from p\ is exactly the same as the process to obtain p2 from pi, but the sign 
of 6 is flipped. Thus, the formulae for p2 and p6 are the same, except that the sign on 6 is 
flipped. The same relationship holds for p 3 and ps. □ 
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Corollary 3.7. There are no proper elliptic lists of length 7 over d = 3. 



Proof. Note that the "a" -component of p^ in the proof of Corollary 3J3 is congruent to —1 
modulo 3, as was the "a" component of p\. If there were a proper elliptic list of length 7, 
then using p 4 as the initial point of an elliptic list of length 4 over 3, we see from Theorem 



3.5 that the "a"-component of pj would have to be —(—a — 2) — 2, which is a, and thus 



p 7 = pi, contradicting that the list of length 7 is a proper list. □ 

The following result allows some efficiency in searching for proper elliptic six cycles: 

Theorem 3.8. If p = a 2 + 3b 2 is part of a proper elliptic 6-cycle over d = 3, then a = 7 —1 
and 7\b. 



Proof. The proof is entirely computational, taking the orders found in Corollary 3.6, and 
then computing all the primes modulo 7. We find that at least one is divisible by 7, a 
contradiction, except in the case that a =7 — 1 and 7\b. Then every prime in the cycle is 
equivalent to 1 modulo 7. The cases are given in Table [T] in Appendix [B] □ 



Due to the structure imposed by Theorem 3J2 it is clear that we can determine all the 
primes in a proper elliptic 6-cycle given a single prime in the cycle. Using divisibility by 7 
to eliminate possible cases, we wrote a computer program to search the remaining values of 
a and b to find 6-cycles. It found them almost immediately, with the smallest being 

(275269, 274723, 275227, 276277, 276823, 276319) 3 , 



corresponding to (a, b) = (251,266) (see Corollary 3.6 for notation). Interestingly enough, if 
we let c = 275772 = 525 2 + 3 • 7 2 , and compute the six orders of Theorem 2.3, then we get 
the six primes given above. Of course, Theorem 2.3 does not apply here as c is composite, 
but it just so happens that c + 1 is prime (this is not the case in general). 

The concept of a proper elliptic 6-cycle is similar to the notion of an aliquot cycle defined 
by Silverman and Stange [5], except that an aliquot cycle fixes a curve E such that N Pl = 
P2,N P2 = p 3 ,...,N Pn = p\. It is not too difficult to see that any proper elliptic cycle can 
be made into an aliquot cycle. Find curves Ei/¥ Pi , 1 < i < n such that N Pi = pi + i for 
1 < i < n — 1 and N Pn = p\. The coefficients of Ei are only defined uniquely modulo pi, 

n 

so we can use the Chinese Remainder Theorem to find the unique coefficients modulo Yl Pi 

i=l 

which are equivalent to the coefficients of E^ modulo Pi for all 1 < i < n. In the case of the 
list above, we can rewrite it as 

(274723, 275269, 276319, 276823, 276277, 275227) 3 

to get the smallest (normalized) aliquot cycle corresponding to the curve E : y 2 = x 3 + 15. 
In the course of computing the cycle above, we also found other 6-cycles with 3 primes 
represented, each twice. Here, pi = p 2 , Pa = P5, and p 3 = p 6 , so that p\ and p 4 are the so- 
called anomalous primes. We found 3 cycles of this form with primes less than one million. 
They are: 

(114661, 114661, 115249, 115837, 115837, 115249) 3 , 
(169219, 169219, 169933, 170647, 170647, 169933) 3 , 
(283669, 283669, 284593, 285517, 285517, 284593) 3 . 
After these cycles, the next smallest one has primes greater than ten million. 



4. Properties of Proper Elliptic Lists 



We saw in section [3] that proper elliptic lists over d = 3 have length no longer than six. 
In this section, we explore proper elliptic lists over d ^ 3. Such lists are either increasing or 
decreasing (because #E(W P ) = p + 1 ± a; see the proof of Theorem 3.4), so we will assume 
throughout that lists are written in ascending order. 

Theorem 2J$ allows us to describe any proper elliptic list over d ^ 3 if we have just 
one of its members. The following Theorem is an extension of Theorem 2.8, and follows 
immediately from it and the definition of an elliptic list: 

Theorem 4.1. Let (pi, . . . ,p n )d be a proper elliptic list over d ^ 3, and let a pi , . . . , a Pn and 
b Pl , . . . , b Pn be the unique positive integers such that 4pi = a p . + db 2 . for each i = 1, . . . ,n. 
Then a Pi = a Pl + 2i — 2 and b Pi = b Pl for each i = 1, . . . , n. 

Theorem 4.1. Let d ^ 3 be a squarefree positive integer. Consider a prime number p\ 
which is of the form 4pi = a 2 + db 2 . If pi is the initial term of a proper elliptic list of length 
n over d, then the quadratic polynomial x 2 + ax + p\ has n consecutive prime values for 
x = 0, 1 n — 1. 



Theorem 4.1 implies that any proper elliptic list (pi, . . . ,p n )d over d ^ 3 is generated by 
n consecutive prime values of the quadratic polynomial in i 

^((2i + ai ) 2 + dbj) 

= i 2 + aii +pi 

for i — 0, 1, . . . , n — 1. Conversely, any such polynomial will generate an elliptic list. There- 
fore, the problem of finding proper elliptic lists over d ^ 3 is equivalent to finding prime- 
generating polynomials of the form above. 
The longest proper list we've found so far is: 

(41, 43, 47, 53, 61, 71, 83,97, 113, 131, 151, 173, 197, 223, 251, 281, 313, 

347, 383, 421, 461, 503, 547, 593, 641, 691, 743, 797, 853, 911, 

971, 1033, 1097, 1163, 1231, 1301, 1373, 1447, 1523, 1601)i 63 . 

This list corresponds to the famous polynomial n 2 +n+41, which is prime for n — 0,1, ... , 39. 
It is still unclear whether proper elliptic lists of arbitrarily long length exist, although we 



have an upper bound for the length given d in Theorem 4.2 



Theorem 4.2. Let d =§ 3, d ^ 3 (or d = 3 and j ^ 0). Let z be the smallest prime such 
that {-^) 7^ —1- Then there are no proper elliptic lists over d of length n> z. 

Proof. Let (pi, . . . , p n )d be an elliptic list of length n. Let a«, bi be the unique positive integers 
such that 4pj = a 2 + db 2 , and note that for all 1 < i < n, = ai + 2i — 2, b{ = b\ = b 
(Theorem 2.8). 

First consider the case (—) = 0. Assume that n > z. The numbers ai,a 2 ,. . . , a n take 
every value modulo z because z is odd and the czj's increment by two, so one of them, say 
aj, will be divisible by z. Therefore, 

4 Pj = a 2 + db 2 = z + • b = z 0, 

and thus z\pj, a contradiction unless z = pj, which we cover below. 
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Now consider the case f — J = 1. Assume that n > z. As before, the numbers ai, 02, . . . , a n 
take every value modulo z, so one of them, say aj, will satisfy aj = z b\J—d. Therefore, 

4 Pj = a 2 + db 2 = z -db 2 + db 2 = z 0, 

implying that z\pj, a contradiction unless z — Pj, which we cover below. 

It remains only to consider the case that one of the elements in the cycle is in fact z. The 
smallest number which can be written as |(a 2 + db 2 ) for a, b £ N is at least 2±1 5 and z is 
never more than this value, so we only have to look at the case pi — z — In this case, 
ai =b\ = 1, so Pi = ( 2t ~^) +d ; an( j — (^-U + ( ^ 42 ~ 1 ^ = ^ 2 i s composite. □ 

In particular, we see that for d — 3,j ^ 0, (^) = 0, so we cannot construct any proper 
elliptic lists of length n > 3 in this case - only elliptic pairs. 

Corollary 4.3. Assume that d = 8 3, and d ^ 3. If d ^e 2 4 19, i/ien there do not exist any 
proper elliptic lists of length n > 3 over d. 

Proof. By hypothesis, d =24 3 or 11. In the first case, = 0, and in the latter case, 

(^)=1- ° 
Definition 4.4. Restrict d to be a positive and square-free integer. 

j^Kol) — / rc^ 11 ! 2 > 1 : z P r i me an d y-j-) 7^ — 1} if d =$ 3 
1 1 otherwise 

Ai(d) is the maximum allowable list-length function. 

For (i 3, there are no lists of any length, motivating our definition of A4(d) = 1. For 
d =g 3, the value of A4(c?) is motivated by Theorem 4.2. Note that in the case d = 3, there 
exist proper elliptic lists of length up to 6, so Ai(3) = 2 is less than the longest proper 
elliptic list: This happens in this case only, although this bound holds for representative 
curves with j ^ 0. 

Currently we have no guarantee that any list of length Ai(d) — 1 exists over d, motivating 
our next definition: 

Definition 4.5. Restrict d to be a positive and square-free integer. Define 
C(d) = max{n|(pi, ...,p n ) d is a proper elliptic list}. 

Also define 

f{d) =M{d)-C{d). 

Except for d = 3 we have C(d) < Ai(d) and f(d) > 0. We suspect that f(d) is related to 
the class number h(—d) in some way, but we have not been able to prove any results so far, 
other than the fact that f(d) = 1 if h(—d) = 1. 



5. The Relationship between Elliptic Pairs and Current Conjectures 

The distribution of elliptic pairs is of primary importance because it determines the time 
and space complexity of algorithms for generating elliptic curves of prime order (see [2J, for 
example). Although thus far nobody has explicitly formulated a conjecture for this, many 
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similar heuristics and conjectures (see [2] , [5] , [3] , [8] ) suggest that the number of elliptic pairs 
iPi l)d with primes p < q less than X should be asymptotic to 

c, x 



log 2 X 



for some constant Cd as X — >■ oo. It is believed that C<2 is greater than zero for all positive 
square-free integers d = 8 3, but so far it is not even known if the number of elliptic pairs for 
any given d is infinite. 

The remark at the end of Section [2] indicates that for every pair of primes within each 
other's Hasse interval, we have an elliptic pair. By the prime number theorem, for any given 
p, the probability that another number q near it is prime is approximately 1/logp, so p 
forms an elliptic pair with about 4 Ai /p/logp primes, of which roughly l^fp j \ogp are greater 



than p (so that we only consider unique elliptic pairs, since Theorem 2.7 indicates that the 



order of p and q does not matter). Since d < Ap — 1 and d =§ 3, we have roughly p/2 values 
of d which could make (p, q)d an elliptic pair, but each square-free d is equivalent to |v/f of 
these values (obtained by multiplying d by the squares of odd numbers), so we'd expect any 
particular d to be chosen with probability (2^/logp)/ (|/ (fv/f)) = 2/ \fd\ogp. Since 
ir(X) ~ i^ry; this suggests to us that for any given d, the number of elliptic pairs with 
primes less than sufficiently large X should be about 

v - v v - — . 

^ x \fd\ogp ~ Vd\og(n\ogn) ^ \fd\ogn \fdlog 2 X 

Because the above sum diverges as X — > oo, we see that for at least one value of d, there must 
be an infinite number of elliptic pairs. Furthermore, we would expect that Cd/Cd> ~ \fdfjd 
as a first-order approximation. Unfortunately, this seems to contradict experimental data 
obtained by Silverman and Stange in Section 9 of [5] , which shows a reciprocal relationship 
for <i's with class number h(—d) = 1. As —d grows larger, however, the frequency of elliptic 
pairs decreases in general. Therefore, it is likely that our heuristic must be altered to include 
the class number in some way. Replacing ^= by r^z^yp gives the closest results to our 
analysis, although we have no heuristic reason why this formula should be chosen. 

We computed d for every possible pair of primes (p, q), each less than 10 7 , and examined 
the results for all d = 8 3 such that h(—d) = 1,2,3,4. We found that Cd ~ ^ m~ivp as 
Cd — > oo, in agreement with our guess, with C ~ 0.16. Unfortunately, ^T^p < 13 for all 
the values we looked at, so our results are ineffective in computing the actual value of Cd- 
Furthermore, the value C3 ~ 1.757 is about 6.26 times greater than expected, so it is likely 
that the d = 3 case must be examined using a different heuristic, just as it had to be treated 
separately earlier. Our results are given in Figure [TJ with the data listed in Appendix [Cj 

Elliptic pairs are also related to the Bunyakowsky conjecture for quadratic polynomials. 
The Bunyakowski conjecture states that all irreducible polynomials p(x) with integer coeffi- 
cients of degree greater than or equal to two such that there does not exist a prime m which 
divides p(x) for all integers x take on an infinite number of prime values. Such polynomials 
are called Bunyakowski polynomials. The case for polynomials of degree one was proven by 
Dirichlet. 
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Figure 1. Plot of the number of elliptic pairs {p,q)d with p,q < X 



divided by 



x 



function of 



\h(-d)f 



10 7 

for d =8 3 and h(—d) < 4. Note that 



we had to treat the <i = 3 case (open diamond) separate from the others, as 
always. The linear fit suggests that our asymptotic relation, Cd " — — 
correct as Cd — > oo. 



is 



Theorem 5.1. The Bunyakowski conjecture (for quadratic polynomials) implies that there 
are an infinite number of anomalous primes (and thus elliptic pairs) over any d =§ 3. 

Proof. Let d — 3, and let {p,p)3 be an elliptic pair. Then p — p + 1 + a — 3b, so a = 3b — 1. 
As p = a 2 + 36 2 , we have that 

p(b) = (36 - l) 2 + 3b 2 = 12b 2 -66 + 1, 

which is easily checked to be a Bunyakowski polynomial. 

If d ^ 3, then (p,p)d is an elliptic pair if and only if p = p + 1 — a, or a = 1. Thus, 
p = |(1 + g?6 2 ). We know that 6 must be odd so that p is an integer, so we set 6 = 2c + 1 
and then 

p(c) = J(l + d(2c + l) 2 ) = cfc 2 + cfc + 

Since 4|(1 + d), this polynomial has integer coefficients, and it is easy to check that it is a 
Bunyakowski polynomial. □ 

Appendix A. Proof of Theorem 12.31 

We follow the proof for curves of the form E : y 2 = x 3 — kx given in [7j. 

Let E : y 2 = x 3 + k be an elliptic curve defined over F p , with A; G F* and p > 5 prime. 
If p = 3 2, then every value modulo p is a cubic residue, so x 3 takes on every value modulo 
p, and x 3 + k does as well. Of the values modulo p, y 2 = has only one solution, while 
y 2 = a e Fp has either zero or two solutions, depending on whether a is a quadratic residue 
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or non-residue. The number of each is the same, so this gives us p points. Adding the point 
at infinity O, we have that 

#E(F p )=p + l. 

Now let p =3 1. Choose a primitive root g modulo p and let Xei^) — e y7r//3 be a Dirichlet 
character. Then x\ = Xs and xl = X2- 

Lemma A.l. Let p = 3 1 &e prime and let x G F* . T/jen 

t-i 

# { MG F p x | U ( = ,} = ^ Xi (x/ 

/ortG {2,3,6}. 

Proof. Since p = 3 1, we also have that p = 6 1, so there are six sixth roots of one in F*. 
Therefore, if there is a solution to u 6 = x, there are six solutions. Write x = p gK Then x is 
a sixth power modulo p if and only if 6|j. We have 

j^X^Y = Y<e^l\ 

which evaluates to six if 6\j and to zero otherwise, giving us exactly the number of u for 
which m 6 = p x. This proves the lemma for t = 6; the proofs for t = 2 and t = 3 follow 
similarly. □ 

Lemma A. 2. Let p = 3 1 be prime. Then 

E 

&eF* 

is p — 1 if 6\£ and is zero otherwise. 

Proof. If 6|£, then all the terms in the sum are 1, so the sum is p — 1. Otherwise, XsidY 1- 
Multiplying by g permutes the elements of F* , so 

X6G?) £ E ^(^ = E X6 (</&)' = E X6(C)', 

feeF* fteF* ceF* 

which is the original sum. As XeidY 1> the sum must be zero. □ 

We now show that the number of points on E can be expressed in terms of Jacobi sums. 
By separating out the terms where x = and y = 0, we find that the number of points is 

#{0} + #{y : y 2 = k} + #{* : a; 3 = —k} + E #fo : V* = a }#{* : x * = " 6 >- 

a+b=k;a,by^0 
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By Lemma 



A.l 



1 2 

the first three terms evaluate to 1, ^2 X2{kY , and X3(~k) £ , respectively. 
The latter summation expands to 

1 2 



53 Ma)° + X2(a) 1 ][ X3 (a - + X 3 (a - k) 1 + X3 (a - k) 2 ] 



a^=0,k 



5^ [1 + Xa(a) + X3<a - fc) + X 2 (a)x 3 (a - k) + % 3 (a - + X2(a)X3(a - A;) 2 ] 



=(p - 2) - X2O) - Xs(-fc) + 53 ^(a)X3(a - A;) - X3(~k) 2 + 53 Xz(. a )Xa(. a - kf 

a^0,k a^O.fc 



We have used Lemma A. 2 to replace the sums of single characters X with the negative value 
x(±/c) that was omitted from the sum. Combining with the terms from before, this simplifies 
to 

P + 1 + 53 X2(a)x3(a - A;) + 53 X2(a)x 3 (a ~ k f 
=P + 1 + Xe(-l) 2 53 X2(a)x 3 (k - a) + x 6 (-l) 4 53 X2(a) X3 (k - a) 2 
=p+l + X6 (k)- 1 X2(a/k) X 3((k-a)/k) + x 6 (k)- 1 53 X2(a/k) X3 ((k - a) A) 2 

a/fc^0,l a/fc^0,l 

=P + 1 + Xe(k)- 1 J( X 2, Xs) + Xe(k)- 1 J(x2, xl), 

where J( X 2, X3) os the Jacobi sum. 
Note that if we write 

#£(F p ) = p+l-a-a, 
then a = — Xe(k)~ 1 J(x2, X 3 )> which is evaluated in pp. 

Appendix B. Proof of Theorem 13.81 



Let pi = a 2 + 3fe 2 , with a 



•1 and the sign on b chosen such that p<i = p\ + 1 + a — 3b, 



and assume that (pi,P2,P3,P4->P5,P6) is a proper elliptic cycle. By Corollary 3.6, a and b 
determine the cycle uniquely. We enumerate over all the possible choices of a and b modulo 



7 in Table 



In the last column, we take Y[ Pi mod 7. If this is 0, then at least one Pi is not 



i=l 



prime (since 7 is not part of a proper elliptic cycle of length 6). Only when a =7 6 =7 — 1 
and 6 =7 do we get a 1 in the last column and the possibility of a non-trivial proper elliptic 
cycle. 

Appendix C. Data for Asymptotic Evaluation of C d 

We conjecture that the number of elliptic pairs (p, q)d with p < q less than some given 
upper bound X is asymptotic to Cd lo ^ x as X — > 00, with C a 



[h(-d)2 



as Ch —> 00. Of 



course, Cd is bounded, and it is frequently very small, so this relation is computationally 
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Table 1. Primes in Elliptic Cycles Modulo 7 
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ineffective. The data, shown in Figure [TJ support this conjecture, however. The rest of this 
appendix consists of a table (Table [2]) of the data we collected for values of d with class 
number h(—d) < 4. 
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Table 2. Y = the Number of Elliptic Pairs (p, q) d with p < g < X = 10 7 
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X/ log 2 X 
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